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WE CLAIM; 



. A computer program product comprLg . computer program operable ,o contro, 

5 a computer to reverse an alteration to a stored computer file, said computer program 
comprising: \ 

file comparing logic operable to compare said stored computer file with an 
archive copy of said computer file stored when said stored computer file was created; and 
alteration reversal logic operable if said file comparing logic detects that said 
10 stored computer file and said archive computer file do not match to replace said stored 
computer file with said archive copy of said computer file. 



2. A computer program product as claimed in e % laim 1, wherein said archive copy of 
said computer file is stored in one of: 

1 5 an unencrypted form; 

an encrypted form; 
an encrypted media; 
an encrypted volume; and 
a PGP disk. 

20 

3. A computer program product as claimed in claim l,\wherein said archive copy of 
said computer file is stored in one of: 

a different physical storage device to said stored computer file; and 
a different part of a common physical storage device sft^red with stored computer 

25 file. 



30 



4. A computer program product as claimed in claim 1, wherein\a subset of file types 
stored by said computer are subject comparison by said file comparing logic and to 
creation of an archive copy for use with said file comparing logic. 
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5. A computer prograJji product as claimed in claim 4, wherein said subset of file 
types include one or more 

executable file typest and 
dynamic link library Vile types. 

6. A computer program product as claimed in claim 1, comprising archive file copy 
logic operable upon creation on said stored computer file to also created said archive copy 
of said computer file. 



10 7. A computer program product as claimed in claim 6, wherein said archive file copy 
logic operates to create said archivkcopy of said computer file for a subset of file types 
stored by said computer. 



8. A computer program product a^ claimed in claim 7, wherein said subset of file 
15 types include one or more of: 

executable file types; and 
dynamic link library file types. 

9. A computer program product as claused in claim 1, wherein said alteration is a 
20 malicious alteration. 

10. A method of detecting a malicious alteration to a stored computer file, said 
method comprising the steps of: 

comparing said stored computer file with an\irchive copy of said computer file* 
25 stored when said stored computer file was created; 

if said file comparing step detects that said storki computer file and said archive 
computer file do not match, replacing said stored computer file with said archive copy of 
said computer file. 

30 11. A method as claimed in claim 10, wherein said archiv^ copy of said computer file 
is stored in one of: 
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an unencrypted form; 
an encrypte^i form; 
an encrypted media; 
an encrypted volume; and 
a PGP disk. 



12. A method as claimed in claim 10, wherein said archive copy of said computer file 
is stored in one of: \^ 

a different physical storage device to said stored computer file; and 
10 a different part of a common physical storage device shared with stored computer 

file. \ 



13. A method as claimed in claim 10, wherein a subset of file types stored by said 
computer are subject comparison by said file comparing logic and to creation of an 
15 archive copy for use in said comparing^ step. 



14. A method as claimed in claim 13\ wherein said subset of file types include one or 
more of: 

executable file types; and 
20 dynamic link library file types. 

15. A method as claimed in claim 10, comprising the step of upon creation of said 
stored computer file also creating said archive copy of said computer file. 

25 16. A method as claimed in claim 15, wherein saia. step of creating said archive copy 
operates to create said archive copy of said computer fii^for a subset of file types stored 
by said computer. 

17. A method as claimed in claim 16, wherein said subset 3$ file types include one or 
30 more of: 

executable file types; and 
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dynamic linW library file types. 



18. A method as claimed in claim 10 5 wherein said alteration is a malicious alteration. 



5 19. Apparatus for processing data operable to detect an alteration to a stored computer 
file, said apparatus comprising: 

a file comparitor operable to compare said stored computer file with an archive 
copy of said computer file stored when said stored computer file was created; and 

a comparison responder operable if said file comparing logic detects that said 
10 stored computer file and said archive computer file do not match to replace said stored 
computer file with said archive copy of said computer file. 



20. Apparatus as claimed in claip 19, wherein said archive copy of said computer file 
is stored in one of: 

15 an unencrypted form; 

an encrypted form; 
an encrypted media; 
an encrypted volume; and 
a PGP disk. 

20 

21. Apparatus as claimed in claim 19, Wherein said archive copy of said computer file 
is stored in one of: 

a different physical storage device to s&id stored computer file; and 
a different part of a common physical storage device shared with stored computer 

25 file. 




22. Apparatus as claimed in claim 19, wherein a subset of file types stored by said 
computer are subject comparison by said file comparitor and to creation of an archive 
copy for use with said file comparitor. 
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23. Apparatus as claimed in claim 22, wherein said subset of file types include one or 
more of: \ * 

executable file types; and 
dynamic link literary file types. 

24. Apparatus as claimed in claim 19, comprising an archive file copier operable 
upon creation of said stored computer file to also created said archive copy of said 
computer file. \ 



25. Apparatus as claimed in claim 24, wherein said archive file copier operates to 
create said archive copy of said^computer file for a subset of file types stored by said 
computer. \ 

26. Apparatus as claimed in claim 25, wherein said subset of file types include one or 
more of: \ 

executable file types; and \ 
dynamic link library file types. \ 

27. Apparatus as claimed in claim 19, wherein said alteration is a malicious alteration. 
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